<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title>kali工具箱</title>
<script src="./static/bootstrap.min.js"></script>
<link rel="stylesheet" href="./static/main.css">
<link rel="stylesheet" href="./static/bootstrap.min.css">
<style type="text/css" id="syntaxhighlighteranchor"></style>
</head>
<main class="main-container ng-scope" ng-view="">
<div class="main receptacle post-view ng-scope">
<article class="entry ng-scope" ng-controller="EntryCtrl" ui-lightbox="">
<section class="entry-content ng-binding" ng-bind-html="postContentTrustedHtml">
<section class="l-section"><div class="l-section-h i-cf"><h2>Foremost Package Description</h2>
<p style="text-align: justify;">Foremost is a forensic program to recover lost files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.</p>
<p>Source: http://foremost.sourceforge.net/<br>
<a href="http://foremost.sourceforge.net/" variation="deepblue" target="blank">Foremost Homepage</a> | <a href="http://git.kali.org/gitweb/?p=packages/foremost.git;a=summary" variation="deepblue" target="blank">Kali Foremost Repo</a></p>
<ul>
<li>Author: US Government</li>
<li>License: Public Domain</li>
</ul>
<h3>Tools included in the foremost package</h3>
<h5>foremost – Forensic program to recover lost files</h5>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="daa8b5b5ae9ab1bbb6b3">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# foremost -h<br>
foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.<br>
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t &lt;type&gt;] [-s &lt;blocks&gt;] [-k &lt;size&gt;]<br>
    [-b &lt;size&gt;] [-c &lt;file&gt;] [-o &lt;dir&gt;] [-i &lt;file]<br>
<br>
-V  - display copyright information and exit<br>
-t  - specify file type.  (-t jpeg,pdf ...)<br>
-d  - turn on indirect block detection (for UNIX file-systems)<br>
-i  - specify input file (default is stdin)<br>
-a  - Write all headers, perform no error detection (corrupted files)<br>
-w  - Only write the audit file, do not write any detected files to the disk<br>
-o  - set output directory (defaults to output)<br>
-c  - set configuration file to use (defaults to foremost.conf)<br>
-q  - enables quick mode. Search are performed on 512 byte boundaries.<br>
-Q  - enables quiet mode. Suppress output messages.<br>
-v  - verbose mode. Logs all messages to screen</code>
<h3>foremost Usage Example
</h3><p>Search for a selection of file types <b><i>(-t doc,jpg,pdf,xls)</i></b> in the given image file <b><i>(-i image.dd)</i></b>:</p>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="5f2d30302b1f343e3336">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# foremost -t doc,jpg,pdf,xls -i image.dd <br>
Processing: image.dd<br>
|*|<br>
<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="295b46465d6942484540">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# ls output/<br>
audit.txt  jpg  pdf</code>
</div></section><div style="display:none">
<script src="//s11.cnzz.com/z_stat.php?id=1260038378&web_id=1260038378" language="JavaScript"></script>
</div>
</main></body></html>
